CVE-2026-29772: Astro @astrojs/node DOS Vulnerability

CVE-2026-29772 Overview

CVE-2026-29772 is a Resource Exhaustion vulnerability affecting Astro, a popular web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves approximately 15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server.

The /_server-islands/[name] route is registered on all Astro SSR apps regardless of whether any component uses server:defer, and the body is parsed before the island name is validated, making any Astro SSR app with the Node standalone adapter vulnerable to this attack.

Critical Impact

Unauthenticated attackers can crash Astro SSR applications with a single malicious request, causing complete denial of service through memory exhaustion.

Affected Products

• Astro @astrojs/node versions prior to 10.0.0
• Astro SSR applications using the Node standalone adapter
• Any Astro deployment with Server-Side Rendering enabled

Discovery Timeline

• 2026-03-24 - CVE-2026-29772 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-29772

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue lies in how Astro handles incoming POST requests to its Server Islands endpoint. The Server Islands feature, designed to enable deferred component rendering, exposes a route at /_server-islands/[name] that accepts JSON payloads.

The vulnerable code path buffers the entire request body in memory before passing it to JSON.parse(). JavaScript's V8 engine allocates individual heap objects for each parsed JSON element, creating a significant memory amplification effect. Testing has shown that a carefully crafted payload containing many small JSON objects can achieve approximately 15x memory amplification from wire bytes to heap bytes.

What makes this vulnerability particularly dangerous is that the route exists on all Astro SSR applications, regardless of whether they actually use the server:defer directive. Furthermore, the JSON parsing occurs before any validation of the island name parameter, meaning there is no opportunity to reject invalid requests before memory allocation occurs.

Root Cause

The root cause is the absence of request body size limits in the Server Islands POST handler. The application reads the complete request body into memory without any safeguards, then parses it as JSON without considering the memory implications of V8's object allocation strategy for large or deeply nested JSON structures.

Attack Vector

This vulnerability is exploitable over the network by any unauthenticated attacker who can send HTTP POST requests to the target application. The attack requires no user interaction and has low complexity to execute.

An attacker constructs a JSON payload containing thousands of small objects or arrays, which when parsed by JSON.parse(), causes V8 to allocate significantly more heap memory than the original payload size. By sending one or more such requests, the attacker can exhaust the Node.js process heap, causing the application to crash with an out-of-memory error.

The attack targets the /_server-islands/[name] endpoint, which is accessible on any Astro SSR deployment using the Node adapter, even if the application doesn't explicitly use Server Islands features.

Detection Methods for CVE-2026-29772

Indicators of Compromise

• Unusual spikes in memory usage on Node.js processes running Astro applications
• Application crashes with out-of-memory errors in Node.js
• Large POST requests to /_server-islands/* endpoints in access logs
• Repeated requests from single IP addresses targeting Server Islands routes

Detection Strategies

• Monitor Node.js heap memory usage and set alerts for abnormal growth patterns
• Implement web application firewall rules to detect oversized POST bodies targeting /_server-islands/ paths
• Review access logs for suspicious POST request patterns to Server Islands endpoints
• Track process restart frequency to identify potential DoS attacks causing crashes

Monitoring Recommendations

• Configure application performance monitoring to track V8 heap allocation rates
• Implement request body size logging for Server Islands endpoints
• Set up alerts for Node.js process terminations related to memory exhaustion
• Monitor network traffic for large JSON payloads directed at SSR application endpoints

How to Mitigate CVE-2026-29772

Immediate Actions Required

• Upgrade Astro to version 10.0.0 or later immediately
• If immediate patching is not possible, implement request body size limits at the reverse proxy or load balancer level
• Consider temporarily blocking POST requests to /_server-islands/* if Server Islands are not in use
• Review application logs for potential exploitation attempts

Patch Information

This vulnerability has been patched in Astro version 10.0.0. The fix implements proper request body size limits on the Server Islands POST handler, preventing the memory amplification attack. Organizations should upgrade to version 10.0.0 or later to remediate this vulnerability.

For detailed information about the patch and the security advisory, refer to the GitHub Security Advisory GHSA-3rmj-9m5h-8fpv.

Workarounds

• Configure reverse proxy (nginx, Apache, or cloud load balancer) to limit request body sizes for /_server-islands/* routes
• Implement rate limiting on Server Islands endpoints to slow potential attackers
• Deploy web application firewall rules to block unusually large JSON POST requests
• If Server Islands functionality is not required, consider disabling or blocking access to the endpoint at the network level

# Nginx configuration to limit request body size for Server Islands endpoint
location /_server-islands/ {
    client_max_body_size 1m;
    limit_req zone=server_islands burst=10 nodelay;
}